Built in Rust, Vector is blistering fast and memory efficient. It's designed to handle the most demanding environments.
Vector does not favor any specific storage. It fosters a fair, open ecosystem with the user's best interest in mind.
Vector unifies logs, metrics, and events at the source, making it collect and ship all observability data.
An embedded LUA engine makes it easy to program powerful transforms. Handle complex use cases without limitations.
Vector is clear on it's guarantees, helping you to make the appropriate trade offs for your use case.
| Vector | Filebeat | FluentBit | FluentD | Logstash | SplunkHF | SplunkUF | |
|---|---|---|---|---|---|---|---|
| Disk buffer persistence | ✔ | ✔ | 𝘅 | 𝘅 | ⚠ | ✔ | ✔ |
| File rotate (create) | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
| File rotate (copytruncate) | ✔ | 𝘅 | 𝘅 | 𝘅 | 𝘅 | ✔ | ✔ |
| File truncation | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
| Process (SIGHUP) | ✔ | 𝘅 | 𝘅 | 𝘅 | ⚠ | ✔ | ✔ |
| TCP Streaming | ✔ | 𝘅 | 𝘅 | 𝘅 | 𝘅 | ✔ | ✔ |
| JSON (wrapped) | ✔ | ✔ | 𝘅 | ✔ | ✔ | ✔ | ✔ |
vector.toml
[sources.logs]
type = 'file'
include = ['/var/log/app*.log']
start_at_beginning = false
ignore_older = 3600
[transforms.tokenizer]
inputs = ['logs']
type = 'tokenizer'
field_names = ["timestamp", "level", "message"]
[transforms.sampler]
inputs = ['tokenizer']
type = 'sampler'
hash_field = 'request_id'
rate = 10
[sinks.es_cluster]
inputs = ['sampler']
type = 'elasticsearch'
host = '123.123.123.123:5000'
[sinks.s3_archive]
inputs = ['tokenizer']
type = 's3'
region = 'us-east-1'
bucket = 'log-archives'
key_prefix = 'date=%F'
Basic metrics support in the context of logs: converting logs to metrics, outputting metrics to popular metrics storages.
LUA runtime, Regex parser, Grok parser, tokenized parser, and more.
Ability to coerce values and define a schema, guaranteeing consistent normalized types for known fields.
Kafka, Kinesis, and SQS consumer sources.
CSV/ORC/Parquet, Big Query, ClickHouse, and more.
List vector instances, view topology, validate config changes, syphon test data, pre-flight testing, observability, and more.
Directly connect to vector instances and live tail the stream, compute aggregates, and get real-time millisecond latency.
by Timber.io
